CVE-2014-0751observed exploitationCWE-22

CVE-2014-0751: vulnerability in GE Proficy HMI/SCADA - CIMPLICITY

GE Proficy HMI/SCADA Path Traversal

Published · Updated

Follow this CVE+ Monitor Proficy HMI/SCADA - CIMPLICITY+ Monitor Proficy Process Systems with CIMPLICITY

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

35Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck.

ssvc Attendcvss 6.8epss 3.1%
from disclosure to weapon
Published on NVDJan 25
VulnCheck+319d
The CIMPLICITY Web-based access component, CimWebServer, does not check the location of shell files being loaded into the system. By modifying the source location, an attacker could send shell code to the CimWebServer which would deploy the nefarious files as part of any SCADA project. This could allow the attacker to execute arbitrary code.
AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected products
GE · Proficy HMI/SCADA - CIMPLICITYGE · Proficy Process Systems with CIMPLICITY
Related CVEs — GE Proficy HMI/SCADA - CIMPLICITY

In the same product, most dangerous first.

CVE-2014-0750—GE Proficy HMI/SCADA Path TraversalEPSS 69.8%